.htaccess Generator

Build Apache .htaccess redirects, caching and security rules with conflict checks

Options

Canonical URL
Canonical host
Trailing slash

/blog/index.html redirects to /blog/.

Custom redirects
Redirects: 0

No custom redirects yet. Add one or switch to bulk paste.

Generated .htaccess

# Generated by the CodingTool.dev .htaccess Generator for Apache 2.4.
# Needs AllowOverride AuthConfig FileInfo Indexes Options (or All); Apache answers 500 for directives it does not allow.
# Place this file in the document root. Test on a staging site before going live.

# Disable directory listings.
Options -Indexes

# Deny access to .htaccess, .htpasswd and other .ht files.
<FilesMatch "^\.ht">
  Require all denied
</FilesMatch>

# Deny backup, dump and editor swap files such as .bak, .old, .sql, .swp and ~ copies.
<FilesMatch "(\.(bak|old|sql|swp)|~)$">
  Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block dotfiles and dot-folders such as .env and .git; keep /.well-known/ reachable.
  RewriteCond %{REQUEST_URI} !(^|/)\.well-known/
  RewriteRule (^|/)\. - [F]

  # Force HTTPS: redirect every HTTP request to the same host over HTTPS.
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

<IfModule mod_headers.c>
  # Basic security headers. Adjust Permissions-Policy if your site uses these features.
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# Compress text responses. AddOutputFilterByType needs mod_filter in Apache 2.4.
<IfModule mod_deflate.c>
  <IfModule mod_filter.c>
    # Text and markup
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
    # Scripts and data
    AddOutputFilterByType DEFLATE text/javascript application/javascript application/json application/ld+json application/manifest+json
    # Feeds and XML
    AddOutputFilterByType DEFLATE application/xml application/rss+xml application/atom+xml
    # SVG and uncompressed fonts
    AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf application/vnd.ms-fontobject
  </IfModule>
</IfModule>

# Browser caching (conservative): short lifetimes that are safe without versioned file names.
<IfModule mod_expires.c>
  ExpiresActive On
  # HTML and data: always revalidate
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType application/json "access plus 0 seconds"
  ExpiresByType application/ld+json "access plus 0 seconds"
  ExpiresByType application/xml "access plus 0 seconds"
  ExpiresByType text/xml "access plus 0 seconds"
  # Feeds
  ExpiresByType application/rss+xml "access plus 1 hour"
  ExpiresByType application/atom+xml "access plus 1 hour"
  # CSS and JavaScript
  ExpiresByType text/css "access plus 1 week"
  ExpiresByType text/javascript "access plus 1 week"
  ExpiresByType application/javascript "access plus 1 week"
  # Web app manifest
  ExpiresByType application/manifest+json "access plus 1 week"
  # Images
  ExpiresByType image/avif "access plus 1 month"
  ExpiresByType image/gif "access plus 1 month"
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType image/webp "access plus 1 month"
  ExpiresByType image/x-icon "access plus 1 month"
  # Fonts
  ExpiresByType font/woff "access plus 1 month"
  ExpiresByType font/woff2 "access plus 1 month"
  ExpiresByType font/ttf "access plus 1 month"
  ExpiresByType font/otf "access plus 1 month"
  ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
  # Audio and video
  ExpiresByType audio/mpeg "access plus 1 month"
  ExpiresByType audio/ogg "access plus 1 month"
  ExpiresByType video/mp4 "access plus 1 month"
  ExpiresByType video/webm "access plus 1 month"
</IfModule>

.htaccess works only where the Apache AllowOverride setting allows these directives.

Saved as htaccess.txt because browsers drop a leading dot. Rename it to .htaccess on the server.

Findings

No conflicts found
Errors: 0 · Warnings: 0 · Redirects: 0

Notes (3)

  • Note: Behind a load balancer or CDN that terminates TLS, %{HTTPS} is off and the HTTPS rule can loop. Check with your host first.

  • Note: Needs AllowOverride AuthConfig, FileInfo, Indexes, Options (or All). A directive outside the allowed set makes Apache answer 500.

  • Note: Blocks for mod_rewrite, mod_headers, mod_deflate, mod_filter, mod_expires are skipped silently when that module is not loaded.

In this file

  • Server options
  • File protection
  • Rewrite rules
  • Response headers
  • Compression
  • Browser caching

Errors: 0 · Warnings: 0 · Redirects: 0

Related Tools

Robots.txt Tester & BuilderTest URLs against robots.txt, trace the deciding rule and build a valid fileGitignore GeneratorGenerate production-ready .gitignore files for any tech stackXML Sitemap Builder & ValidatorBuild, split and validate XML sitemaps, then check URL healthMeta Tag GeneratorGenerate SEO, Open Graph and X meta tags with live previews
What it generates

The generator writes an Apache 2.4 .htaccess file for common redirect, performance and security needs: force HTTPS, one canonical host, trailing-slash and index.html clean-up, custom 301/302/307/308 redirects, gzip compression, Expires caching presets, directory-listing and dotfile protection, basic security headers, optional HSTS and custom error pages. Every section has an inline comment, and the order is always the same so diffs stay readable.

Conflict checks

Before a redirect is written, it is checked for malformed sources, unsafe or unexpected destination protocols, duplicates, self-redirects, A to B to A loops and chains that cost an extra hop. Rules that would loop or never run are left out of the file and listed under Findings. Canonical host and trailing-slash options are single choices, so contradictory rules such as add www and remove www cannot be combined.

Apache details that matter

All rewrite rules share one IfModule mod_rewrite block with a single RewriteEngine On. HTTPS and host changes happen in one redirect, trailing-slash rules skip real files and folders, and slash or index redirects apply only to GET and HEAD requests. Access control uses Require all denied, never the obsolete Order and Deny syntax. Module-dependent blocks are wrapped in IfModule, so a missing module skips a block silently instead of breaking the site.

Before you deploy

.htaccess works only where the server AllowOverride setting allows these directives; otherwise Apache answers 500. Place the file in the document root, because custom redirect paths are relative to it. Behind a proxy or CDN that terminates TLS, the HTTPS rule cannot see the original scheme and may loop. Enable HSTS only after HTTPS works everywhere, starting with a short max-age. Browsers save the download as htaccess.txt; rename it to .htaccess on the server. Everything runs in your browser and nothing is uploaded.

CodingTool is officially live on

Launched on StartupBaseCodingTool.dev - Free, Fast & Easy Developer Tools in One Place | Product HuntCodingTool - Featured on Startup FameFazier badgeListed on Turbo0Featured on Twelve ToolsFeatured on Findly.toolsLaunchpadly Startup DirectoryCodingTool.dev — Featured on Smol Launch